adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2024-12-30 20:56:23 +00:00
Code Issues Projects Releases Packages Wiki Activity

[SCSI] aacraid: fix security weakness

Browse source 
Actually there are several but one is trivially fixed

1.	FSACTL_GET_NEXT_ADAPTER_FIB ioctl does not lock dev->fib_list
but needs to
2.	Ditto for FSACTL_CLOSE_GET_ADAPTER_FIB
3.	It is possible to construct an attack via the SRB ioctls where
the user obtains assorted elevated privileges. Various approaches are
possible, the trivial ones being things like writing to the raw media
via scsi commands and the swap image of other executing programs with
higher privileges.

So the ioctls should be CAP_SYS_RAWIO - at least all the FIB manipulating
ones. This is a bandaid fix for #3 but probably the ioctls should grow
their own capable checks. The other two bugs need someone competent in that
driver to fix them.

Signed-off-by: Alan Cox <alan@redhat.com>
Acked-by: Mark Salyzyn <mark_salyzyn@adaptec.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
This commit is contained in:
Alan Cox 2007-11-07 23:58:10 +00:00 committed by James Bottomley
parent e6096963d2
commit 5f78e89b5f
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/scsi/aacraid/linit.c
View file

@ -636,7 +636,7 @@ static int aac_cfg_open(struct inode *inode, struct file *file)
static int aac_cfg_ioctl(struct inode *inode, struct file *file,
unsigned int cmd, unsigned long arg)
{
if (!capable(CAP_SYS_ADMIN))
if (!capable(CAP_SYS_RAWIO))
return -EPERM;
return aac_do_ioctl(file->private_data, cmd, (void __user *)arg);
}
@ -691,7 +691,7 @@ static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
static long aac_compat_cfg_ioctl(struct file *file, unsigned cmd, unsigned long arg)
{
if (!capable(CAP_SYS_ADMIN))
if (!capable(CAP_SYS_RAWIO))
return -EPERM;
return aac_compat_do_ioctl((struct aac_dev *)file->private_data, cmd, arg);
}